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I. Summary 

LM PGNCS software performance is evaluated with the mode control 
switch in the AUTO, ATT. HOLD and OFF positions for each of the four 
possible single bit failures of the auto and attitude hold mode control discretes. 
The evaluation is then repeated assuming that the DAP can not operate in the 
idling mode while "AVERAGE G" is running, as suggested in PCR 303. A 
comparison of these two preliminary evaluations indicates that the proposed 
DAP modification has several undesirable effects and does not warrant the 
extensive testing necessary to flight qualify it. 

II. Nominal Operation 


The nominal values of the attitude hold mode control discrete, bit 
13 channel 31, and the auto mode control discrete, bit 14 channel 31, cor¬ 
responding to the three mode control switch positions are displayed in 
Table 1. 


MODE CONTROL 
SWITCH POSITION 



BIT 13 

BIT 14 


CHANNEL 31 

CHANNEL 31 

AUTO 

i 

1 

0 

ATT. HOLD 

0 

1 

OFF 

1 

1 


TABLE 1 - Nominal Values of Bits 13 and 14 in Channel 31 








Bits 13 and 14 are both checked in the DAP "CHEKBITS" subroutine and 
in the V43 coding. The ’'CHEKBITS" subroutine causes the DAP to idle 
if both bits are "l". The V43 coding prevents loading of the attitude error 
displays and causes the operator error light to go on if both bits are not 

11 -jit 


After the "CHEKBITS" test, the DAP examines only bit 13 to de¬ 
termine if the mode control switch is in the AUTO or ATT. HOLD position. 
Bit 13 is also examined in the P64 redesignation logic and in the Landing 
Auto Modes Monitor, R13. The P64 redesignation logic does not process 
ACA deflections as redesignations during the P64 redesignation period 
if bit 13 is "0". The R13 logic does not permit early entry into P66 with 
ROD switch activation if bit 13 is "l". 

Bit 14 is checked in "FINDCDUW" and in the "G+ NAUTO" subroutine. 
"FINDCDUW" zeroes all commands to the DAP (desired rates, desired 
attitude increments and attitude error lag angles) when bit 14 is "l". If 
bit 14 is "l", the "G + N AUTO" subroutine results in a flashing V50 N25 
at the beginning of the Master Ignition Routine (Burn Baby Burn) for any 
APS or DPS burn, prevents initiation of R60 attitude maneuvers (although 
the desired FDAI ball angles are displayed), terminates any R60 attitude 
maneuvers already in progress, and prevents automatic maneuvering in the 
Preferred Tracking Attitude Routine, R61, and in the Fine Preferred 
Tracking Attitude Routine, R65, (although the desired FDAI ball angles 
are displayed for both routines). 

III. Current Performance with Discrete Failures 

Since each of the two mode control discretes can fail to a "l" or to 
a "0", there are four distinct single bit failure modes. PGNCS software 
performance must be examined with the mode control switch in the AUTO, 
ATT. HOLD and OFF positions for each of these failure modes to provide 
an adequate system evaluation. 

A. Failure Mode 1 - Bit 13 = 1. 

The bit values corresponding to the three mode control switch posi¬ 
tions with bit 13 failed to "l" are illustrated in Table 2. 




BIT 13 

CHANNEL 31 


BIT 14 
CHANNEL 31 


MODE CONTROL 
SWITCH POSITION 


TABLE 2 - Values of Bits 13 and 14 of Channel 31 with Bit 13 
Failed to " l" 


AUTO 

ATT. HOLD 
OFF 


1 

o 

1 


1 

1 


For this failure mode, PGNCS performance would be nominal with the 
mode control switch in the AUTO and OFF positions. However, if the 
mode control switch were in the ATT. HOLD position, the DAP would 
operate only in the idling mode and would not control attitude, update 
the attitude error needle displays, or implement manual ACA commands. 
Consequently, P66 AUTO could not be selected prior to automatic entry 
at the end of the P64 Approach Phase and P66 MANUAL would be inop¬ 
erative. If the failure occurred with the mode control switch in the 
ATT. HOLD position the vehicle would rotate freely until the mode 
control switch were moved to the AUTO position or AGS were selected. 

B. Failure Mode 2 - bit 14 = 1 


The bit values corresponding to the three mode control switch 
positions with bit 14 failed to n l n are illustrated in Table 3. 


MODE CONTROL 
SWITCH POSITIONS 


BIT 13 BIT 14 

CHANNEL 31 CHANNEL 31 


AUTO 


/ ATT. HOLD 
OFF 


1 

1 

0 

1 

1 

1 

--- 


TABLE 3 - Values of Bits 13 and 14 of Channel 31 with Bit 14 
Failed to M 1" 


For this failure mode, PGNCS performance would be nominal with the 
mode control switch in the ATT. HOLD and OFF positions. If the mode 
control switch were in the AUTO position, the DAP would operate only in 
the idling mode and would not control attitude, update the attitude error 
needle displays or implement steering commands. Consequently, Kalcmanu 







(R60) maneuvers, R61 and R65 Tracking Attitude Routine maneuvers, 
and all APS and DPS burns would require manual attitude control. Landing 
point redesignations could be made with the ACA in P64 only at the expense 
of relinquishing PGNCS attitude control during the time that the redesigna¬ 
tions were being made. If the failure occurred with the mode control 
switch in the AUTO position the vehicle would rotate freely until the mode 
control switch were moved to the ATT. HOLD position or AGS were select¬ 
ed. 


C. Failure Mode 3 - bit 13 = 0 


The bit values corresponding to the three mode control switch posi¬ 
tions with bit 13 failed to n 0 n are illustrated in Table 4. 


MODE CONTROL 
SWITCH POSITION 


BIT 13 BIT 14 

CHANNEL 31 CHANNEL 31 

/ 

AUTO 

/ ATT. HOLD 
OFF 

\ 


0 

o 

o 

1 

0 

- 

■- 1 


TABLE 4 - Values of Bits 13 and 14 of Channel 31 with Bit 13 
Failed to "0 M 


For this failure mode, PGNCS performance would be nominal with the mode 
control switch in the ATT. HOLD position. Since performance with the mode 
control switch in the OFF position would be identical to that in ATT. HOLD, 
the DAP could not be turned off with the mode control switch and the attitude 
error displays could not be loaded with V43. 

If the mode control switch were in the AUTO position, automatic 
steering or maneuver commands would be implemented as usual unless the 
ACA were moved out of the detent position. Moving the ACA out of detent 
about any axis would cause the DAP to enter the manual rate command 
mode, respond to ACA commanded rates and ignore automatic commands 
about all axes until the ACA had returned to detent and the rate damping 
was complete. During powered flight or automatic Kalcmanu maneuvers, 
the vehicle would then immediately begin maneuvering back to the attitude 
commanded by the program. Landing point redesignations with the ACA 




would be ignored by the guidance and implemented by the DAP as manual 
rate commands. 

D. Failure Mode 4 - Bit 14 = 0 

The bit values corresponding to the three mode control switch posi¬ 
tions with bit 14 failed to "0” are illustrated in Table 5. 




BIT 13 

BIT 14 


t 

CHANNEL 31 

CHANNEL 31 

MODE CONTROL 

AUTO 

1 

0 

SWITCH POSITION i 

ATT. HOLD 

0 

0 


OFF 

1 

0 


TABLE 5 - Values of Bits 13 and 14 of Channel 31 with Bit 14 
Failed to n 0" 


In this failure mode, PGNCS performance with the mode control switch in 
the AUTO position would be nominal. Since performance with the mode 
control switch in the OFF position would be identical to that in AUTO, the 
DAP could not be turned OFF with the mode control switch and the attitude 
error displays could not be loaded with V43. 

In the ATT. HOLD mode control switch position, performance would 
be identical to that in AUTO unless the ACA were moved out of detent. If 
the ACA were moved out of detent about any axis at any time, the DAP 
would enter the manual rate command mode, respond to ACA commanded 
rates and ignore automatic commands about all axes until the ACA had 
returned to detent and the rate damping was complete. During powered 
flight or automatic Kalcmanu maneuvers, the vehicle would immediately 
begin maneuvering back to the attitude commanded by the program after 
completion of the rate damping. 

IV. Performance with Discrete Failures if DAP is Prevented from Idling 

When ’’AVERAGEG’' is Set 

PCR 303 suggests that the DAP be modified to not idle if bits 13 and 
14 are both 1 while the ’’AVERAGEG" flag is set. Since, after the "CHEKBITS” 
subroutine, the DAP examines only bit 13 to determine the mode control 





switch position, the DAP would actUdliy function as if AUTO had been 
selected in this case. 

"AVERAGEG" is set at TIG-30 in all APS, DPS and RCS burn 
programs and is reset when a major mode change is requested via V37 
or when a freshstart occurs. Performance in all other mission phases, 
including coasting flight periods with failure modes 1 through 4, would 
be unaffected by the modification. The effects of the proposed modification 
during periods when "AVERAGEG" is set are as follows: 

A. Nominal Operation With "AVERAGEG" Set 

During normal operation, PGNCS performance with the mode control 
switch in the AUTO or ATT. HOLD position would not be affected by the 
modification. However, if "AVERAGEG" were set, the DAP could not be 
turned OFF with the mode control switch. 

B Failure Mode 1 - Bit 13 = 1 - with "AVERAGEG" Set 

In this failure mode, PGNCS performance with the mode control 
switch in the AUTO position would be nominal. If the mode control switch 
were in the ATT. HOLD or OFF position, the DAP would hold attitude 
about the latest desired gimbal angles (CDUDs) but would not implement 
manual rate commands from the ACA (except about the P axis if X-axis 
override were allowed). Attempts to use the ACA for commanding pitch 
or roll rates during the P64 redesignation period would be ignored by the 
DAP and interpreted as landing point redesignations by the guidance pro¬ 
gram. P66 could not be selected prior to automatic entry at the end of 
the P64 approach phase. Since the manual rate command mode would be 
inoperative, P66 MANUAL would be useless. 

C. Failure Mode 2 - Bit 14 = 1 - With "AVERAGEG" Set 

In this failure mode, performance would be nominal with the mode 
control switch in the ATT. HOLD position. If the mode control switch 
were in the AUTO or OFF position, the DAP would hold attitude about the 
latest desired gimbal angles (CDUDs). FINDCDUW would not issue guidance 
commands to the DAP during any APS or DPS burn programs, although the 
attitude error needle displays would be updated properly. 




D. Failure Mode 3 - Bit 13 = 0 - And Failure Mode 4 - Bit 14 = 0 - 
With "AVERAGEG" Set 

PGNCS performance in these failure modes with the mode control 
switch in the AUTO or ATT. HOLD position would be identical to that des¬ 
cribed in Section III. 

V. Discussion 

The DAP modification suggested in PCR 303 can be evaluated by 
comparing the descriptions of performance in Section III and Section IV. 

The modification provides three features not available in the current 
system. First, if either bit fails to M 1 M while the mode select switch is 
in the position which should make it a "0", the vehicle rates will be damped 
and the DAP will hold attitude. Although this automatic rate damping capa¬ 
bility is advantageous if the failure occurs when vehicle rates or offset 
accelerations are large, it could have the disadvantage of concealing potentially 
dangerous failures from the crew. For example, if bit 13 failed to n l n with 
the mode control switch in the ATT. HOLD position, the crew would have 
no immediate indication of the failure. Consequently, subsequent manual 
pitch and roll maneuvers commanded by the crew with the ACA would be 
ignored by the DAP and if commanded during the P64 redesignation period, 
would be processed as landing site redesignations by the guidance program. 
The loss of manual PANCS control capability without crew recognition could 
be extremely dangerous during the final phases of landing. If bit 14 failed 
to n l M with the mode control switch in the AUTO position, FINDCDUW would 
stop sending guidance commands to the DAP. The crew would not be aware 
of the failure until they noticed the drift in the attitude error displays. With 
the current system, the failure could quickly be detected by noting that the 
attitude error needles had frozen and with visual indications of the unchecked 
rotation through the LM windows. The crew could then switch to AGS or 
move the mode control switch to the remaining (not OFF) position to damp 
the rates and regain control. 

The second feature provided by the modification is an attitude error 
display whenever "AVERAGEG" is set for all mode control switch positions 
and all failure modes. Since the freezing of the needles currently provides 



a cue that the selected mode is not functioning and since switching to the 
remaining, functioning mode will cause the needles to work again, this 
characteristic may be undesirable and unnecessary. However, if this 
feature is wanted, the same effect can be obtained with an extremely 
simple, local change to the DAP "CHEKBITS" routine. 

The third feature provided by the modification allows the use of the 
ACA for landing site redesignations in P64 with bit 14 failed to n l" and the 
mode control switch in the AUTO position. Since attitude control would 
have to be entirely manual during a landing with bit 14 failed to "l n , the 
ACA redesignation capability is not essential. 

The proposed modification would also preclude the use of the mode 
control switch for turning off the DAP while "AVERAGEG" is set during 
nominal operation as well as in the failure modes. Although the DAP 
could still be turned off by switching to AGS control, there may be situations 
in which using the mode control switch would be preferable -- for example, 
to terminate jet firings after touchdown if the standard procedure should 
fail. 


Due to the number of routines which examine bits 13 and 14 of 
channel 31, and the complexity of the interactions between those routines, 
a rough analysis such as this is insufficient to determine the effects of 
implementing the proposed modification. Even extensive testing with the 
digital simulator may not uncover all the ramifications of the change. 
Previous experience has shown that modifications involving the interface 
between modes tend to be subject to insidious errors. Since several objec¬ 
tionable effects of the proposed modification have already been determined 
in this preliminary study and the few advantages apply to only half of the 
powered flight failure modes of bits 13 and 14, I feel that PCR 303 does 
not warrant further study. 




